GitHub Advisoryadvisory · npm

GHSA-52r9-g5g6-2hjp Path Traversal in node-srv

MEDIUM Published 2018-07-26 Modified 2023-03-01 Official page ↗
Aliases
CVE-2018-3714
Ecosystem
npm
Packages
node-srv
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm node-srv: < 2.1.1 → fixed in 2.1.1

Description

Versions of `node-srv` before 2.1.1 are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `node-srv`. Recommendation Update to version 2.1.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-3714 node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References